diff --git a/src/decode.rs b/src/decode.rs
index ba02565..6823595 100644
--- a/src/decode.rs
+++ b/src/decode.rs
@@ -58,15 +58,12 @@ where
     let mut run = 0_u16;
 
     for px_out in pixels.iter_mut() {
-        if unlikely(!buf.within_bounds()) {
-            break;
-        }
-
-        // TODO: check for safety that ReadBuf is not over yet
         if run != 0 {
             run -= 1;
             *px_out = px;
             continue;
+        } else if unlikely(!buf.within_bounds()) {
+            return Err(Error::UnexpectedBufferEnd);
         }
 
         let b1 = buf.read();
diff --git a/src/error.rs b/src/error.rs
index 58a5b4f..b1f8e5b 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -12,6 +12,7 @@ pub enum Error {
     InputBufferTooSmall { size: usize, required: usize },
     OutputBufferTooSmall { size: usize, required: usize },
     InvalidMagic { magic: u32 },
+    UnexpectedBufferEnd,
     // TODO: invalid colorspace
 }
 
@@ -38,6 +39,9 @@ impl Display for Error {
             Self::InvalidMagic { magic } => {
                 write!(f, "invalid magic: expected {:?}, got {:?}", QOI_MAGIC, magic)
             }
+            Self::UnexpectedBufferEnd => {
+                write!(f, "unexpected input buffer end while decoding")
+            }
         }
     }
 }